Oracle Reports Developer EUVD-2026-61615

The prerequisite is network HTTP access to an exposed Oracle Reports Developer 14.1.2.0.0 instance (specifically its Security and Authentication component); per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no authentication, user-interaction, or elevated-privilege requirements against an affected deployment. The principal limiting factors are therefore version and exposure: only version 14.1.2.0.0 is listed as affected, and the instance must be reachable over HTTP by the attacker - deployments where the Reports HTTP endpoints are firewalled, internal-only, or behind a VPN are not remotely exploitable. No non-default feature toggle is named by Oracle as required.

The signals that are present point to genuine high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation requiring no user interaction and yielding full compromise, which is why Oracle scored it 9.8. However, several corroborating signals are absent: no EPSS probability was supplied, the vulnerability is not in CISA KEV (no confirmed active exploitation), no SSVC decision data was provided, and no proof-of-concept is referenced. This is therefore a high-CVSS issue whose real-world exploitation likelihood cannot yet be quantified from the data at hand. The absence of a CWE and of technical detail in Oracle's CPU (Oracle habitually withholds specifics until patches propagate) means the exact exploitation mechanism is unverified. Net assessment: treat as a high-priority patch given the 9.8 pre-auth-takeover profile, but note that the low visibility (no EPSS, no KEV, no POC) suggests exploitation is not yet demonstrated to be widespread.

An attacker who can reach the Oracle Reports Developer HTTP interface sends a crafted request that abuses the flaw in the Security and Authentication component to bypass identity checks, requiring no credentials and no user interaction. Because the CVSS complexity is low, the request succeeds reliably against the affected 14.1.2.0.0 build, granting the attacker full control (read, modify, and disrupt) over the Reports instance and the data it processes. No public proof-of-concept is currently identified, so exploitation would require the attacker to independently develop the technique.